topic Re: How to search a list of URLs and add the response times for URLs with similar patterns? in Splunk Search

How to search a list of URLs and add the response times for URLs with similar patterns?

Karan_Jindal — Mon, 29 Jun 2015 16:32:22 GMT

Hi,

I have a Splunk search which gives list of URLs and their corresponding response times like:

/webapp/store/p/product1, 1
/webapp/store/p/product2, 2
/webapp/store/p/product3, 1
/webapp/store/l/list1, 1.12
/webapp/store/l/list2, 0.12
/webapp/store/home, 1.12
/webapp/store/page4, 1.12
/webapp/store/page5, 1.12

Now, I want to do a pattern search on these urls and want to add the response times of similar patterned urls.

Desired output:

/webapp/store/p/, 4
/webapp/store/l/, 1.24
/webapp/store/home, 1.12
/webapp/store/page4, 1.12
/webapp/store/page5, 1.12

Any help would be appreciated.

Thanks

Re: How to search a list of URLs and add the response times for URLs with similar patterns?

martin_mueller — Mon, 29 Jun 2015 17:12:12 GMT

Try this:

base search | rex field=url "^(?<pattern>/[^/]+/[^/]+/[^/]+/?)" | stats sum(response_time) by pattern

Re: How to search a list of URLs and add the response times for URLs with similar patterns?

richgalloway — Mon, 29 Jun 2015 17:17:31 GMT

This should get you started:

... | rex field=URL "(<?PbaseURL>\/\w+\/\w+\/\w+)" | stats sum(time) as totalTime by baseURL | table baseURL totalTime